dc17f60446749b36aecb38e0e47e40f24832340c522173b4508869df0a4c315b

HOSTILE

dc17f60446749b36aecb38e0e47e40f24832340c522173b4508869df0a4c315b · 92%

AI Kawaii-Unicorn VB6 dropper with shell hijack

Mal-ecule

K(Mc)O(As₂)H₇(CmDbDsFPo₃TiU)Md₅(Bi₄BkPaPt)

Size 468.0 KB download

First seen 2 days ago

Analyzed 23 hours ago

Source virussign.com

Also detected by 1 source

Kawaii VB6 write and rename dropper: virussign.com_a01e7eea0525433185cb9e1eab723470.vir:0x238

Kawaii-Unicorn VB6 .die rename sabotage: virussign.com_a01e7eea0525433185cb9e1eab723470.vir:0x238

Kawaii-Unicorn cmd .die hijack: virussign.com_a01e7eea0525433185cb9e1eab723470.vir:0x238

virussign.com_a01e7eea0525433185cb9e1eab723470.vir pe

0x0	4d5a90000300000004000000ffff0000	MZ..............Malformed VB6 Unicorn Photoshop image-carrier sheller
0x10	b8000000000000004000000000000000	........@.......
0x20	00000000000000000000000000000000	................
0x30	000000000000000000000000b8000000	................
0x40	0e1fba0e00b409cd21b8014ccd215468	........!..L.!Th
0x50	69732070726f6772616d2063616e6e6f	is program canno
0x60	742062652072756e20696e20444f5320	t be run in DOS
0x70	6d6f64652e0d0d0a2400000000000000	mode....$.......
0x80	759ff9db31fe978831fe978831fe9788	u...1...1...1...
0x90	b2e2998830fe97887edc9e8830fe9788	....0...~...0...
0xa0	07d89a8830fe97885269636831fe9788	....0...Rich1...
0xb0	0000000000000000504500004c010300	........PE..L...
0xc0	8027435c0000000000000000e0000f01	.'C\............
0xd0	0b01060000b002000090040000000000	................
0xe0	d41300000010000000c0020000004000	..............@.
0xf0	00100000001000000400000001000000	................
0x100	04000000000000000050070000100000	.........P......
0x110	ddd60700020000000000100000100000	................
0x120	00001000	....

0xfa0	00000000000000000000000000000000	................
0xfb0	00000000000000000000000000000000	................
0xfc0	00000000000000000000000000000000	................
0xfd0	00000000000000000000000000000000	................
0xfe0	00000000000000000000000000000000	................
0xff0	00000000000000000000000000000000	................
0x1000	8693a372f909a372ee6aa4723168a472	...r...r.j.r1h.r
0x1010	8dcca1726272a47288bea072ba02a372	...rbr.r...r...r
0x1020	c39fa1724109a372766aa2723ac3a072	...rA..rvj.r:..r
0x1030	74a2a1726e02a372fec1a17205cda172	t..rn..r...r...r
0x1040	3acda1729d49a272f19fa1720603a372	:..r.I.r...r...r
0x1050	0604a372ee94a372ea62a3727d41a172	...r...r.b.r}A.r
0x1060	749ba07210c4a1726c57a272fda09472	t..r...rlW.r...rKawaii-Unicorn VB6 .die rename sabotage
0x1070	f609a3720ac3a1729b05a272879ba072	...r...r...r...rKawaii-Unicorn cmd .die hijack
0x1080	69cea072dc19a2729395a372859aa072	i..r...r...r...rKawaii VB6 write and rename dropper
0x1090	df47a2728906a372ba03a3721375a472	.G.r...r...r.u.r
0x10a0	5057a2725ac6a1724819a2727d69a272	PW.rZ..rH..r}i.r
0x10b0	2b94a37267e8a072103da17237a2a172	+..rg..r.=.r7..r
0x10c0	1856a272ea10a2723a03a3723a04a372	.V.r...r:..r:..r
0x10d0	016ca2726e03a372a9fda272a4359472	.l.rn..r...r.5.r
0x10e0	2f4ea272db76a472c092a372306ca272	/N.r.v.r...r0l.r
0x10f0	edeea2724496a3722198a272134ea272	...rD..r!..r.N.r
0x1100	11dda272ec6ba272af9fa17200000000	...r.k.r...r....
0x1110	21001400aea042000000000000000000	!.....B.........
0x1120	000000002811400008000000059f4200	....(.@.......B.
0x1130	0c9f42001b9f4200679f4200c49f4200	..B...B.g.B...B.
0x1140	d69f42002ea05700a7a0420000000000	..B...W...B.....
0x1150	27001400e0a6420024a74200e8a64200	'.....B.$.B...B.
0x1160	00000000681140000e00000025a14200	....h.@.....%.B.
0x1170	2ca142003ba1420063a14200cca34200	,.B.;.B.c.B...B.
0x1180	f6a342000ea442001da44200b4a44200	..B...B...B...B.
0x1190	56a54200f3a542000ba642001aa64200	V.B...B...B...B.
0x11a0	d9a6420000	..B..

0x1460	00000000000000000000000000000000	................
0x1470	0000000000ff7c0200507c0200000700	......\|..P\|.....
0x1480	556e69636f726e000d010b0049276d20	Unicorn.....I'm Malformed VB6 Unicorn Photoshop image-carrier sheller
0x1490	556e69636f726e000308000080190100	Unicorn.........
0x14a0	420021fd7b02006c740000f57b0200ff	B.!.{..lt...{...
0x14b0	d8ffe10f554578696600004d4d002a00	....UExif..MM.*.
0x14c0	00000800070112000300000001000100	................
0x14d0	00011a00050000000100000062011b00	............b...
0x14e0	05000000010000006a01280003000000	........j.(.....
0x14f0	01000200000131000200000022120000	......1....."...
0x1500	72013200020000001400000094876900	r.2...........i.
0x1510	0400000001000000a8000000d40015f9	................
0x1520	00000027100015f9000000271041646f	...'.......'.AdoKawaii-Unicorn VB6 .die rename sabotage
0x1530	62652050686f746f73686f7020434320	be Photoshop CC
0x1540	32303138202857696e646f7773290032	2018 (Windows).2
0x1550	3031393a30313a30372031393a34343a	019:01:07 19:44:
0x1560	3237000003a001000300000001000100	27..............
0x1570	00a002000400000001000002eea00300	................
0x1580	04000000010000032b00000000000000	........+.......
0x1590	06010300030000000100060000011a00	................
0x15a0	050000000100000122011b0005000000	........".......
0x15b0	010000012a0128000300000001000200	....*.(.........
0x15c0	00020100040000000100000132020200	............2...
0x15d0	040000000100000e1b00000000000000	................
0x15e0	48000000010000004800000001ffd8ff	H.......H.......
0x15f0	ed000c41646f62655f434d0001ffee00	...Adobe_CM.....
0x1600	0e41646f626500648000000001ffdb00	.Adobe.d........
0x1610	84000c08080809080c09090c110b0a0b	................
0x1620	11150f0c0c0f1518131315131318110c	................
0x1630	0c0c0c0c0c110c0c0c0c0c0c0c0c0c0c	................
0x1640	0c0c0c0c0c0c0c0c0c0c0c0c0c0c	..............

0x3d37	61702f312e302f6d6d2f2220786d6c6e	ap/1.0/mm/" xmln
0x3d47	733a73744576743d22687474703a2f2f	s:stEvt="http://
0x3d57	6e732e61646f62652e636f6d2f786170	ns.adobe.com/xap
0x3d67	2f312e302f73547970652f5265736f75	/1.0/sType/Resou
0x3d77	7263654576656e74232220786d6c6e73	rceEvent#" xmlns
0x3d87	3a73745265663d22687474703a2f2f6e	:stRef="http://n
0x3d97	732e61646f62652e636f6d2f7861702f	s.adobe.com/xap/
0x3da7	312e302f73547970652f5265736f75f3	1.0/sType/Resou.
0x3db7	6365526566232220786d703a43726561	ceRef#" xmp:CreaKawaii-Unicorn VB6 .die rename sabotage
0x3dc7	746f72546f6f6c3d2241646f62652050	torTool="Adobe P
0x3dd7	686f746f73686f702043432032303138	hotoshop CC 2018
0x3de7	202857696e646f7773292220786d703a	(Windows)" xmp:
0x3df7	437265617465446174653d2232303138	CreateDate="2018
0x3e07	2d31322d30325431353a35303a30362b	-12-02T15:50:06+
0x3e17	30383a30302220786d703a4d6f646966	08:00" xmp:Modif
0x3e27	79446174653d22323031392d30312d30	yDate="2019-01-0
0x3e37	375431393a34343a32372b30383a3030	7T19:44:27+08:00
0x3e47	2220786d703a4d8c7461646174614461	" xmp:M.tadataDa
0x3e57	74653d22323031392d30312d303754a4	te="2019-01-07T.
0x3e67	393a34343a32372b30383a3030222064	9:44:27+08:00" d
0x3e77	633a666f726d61743d22696d6167652f	c:format="image/
0x3e87	6a706567222070686f746f73686f703a	jpeg" photoshop:
0x3e97	436f6c6f724d6f64653d223322207068	ColorMode="3" ph
0x3ea7	6f746f73686f703a49434350726f6669	otoshop:ICCProfi
0x3eb7	6c653d22735247422049454336313936	le="sRGB IEC6196
0x3ec7	362d322e312220786d704d4d3a496e73	6-2.1" xmpMM:Ins
0x3ed7	74616e636549443d22786d702e696964	tanceID="xmp.iid
0x3ee7	3a64353937343839392d636138382d37	:d5974899-ca88-7
0x3ef7	6634322d393531362d38653736333538	f42-9516-8e76358
0x3f07	30386466332220786d704d4d3a446f63	08df3" xmpMM:Doc
0x3f17	756d656e7449443d2261646f62653a64	umentID="adobe:d
0x3f27	6f6369643a70686f746f73686f703a39	ocid:photoshop:9

Well-known

0x290b2	00350000000000000000d42b0000e727	.5.........+...'
0x290c2	000044004601ff011f00000001060054	..D.F..........T
0x290d2	696d657232000b032823000007702600	imer2...(#...p&.
0x290e2	000890150000ff032000000002050054	........ ......T
0x290f2	65787431000204c003d00267021d010b	ext1.......g....
0x29102	01003000120100ff031f000000030600	..0.............
0x29112	54696d657231000b03b80b000007c021	Timer1.........!
0x29122	000008f8070000ff0347000000040600	.........G......
0x29132	4c6162656c310001010700556e69636f	Label1.....Unico
0x29142	726e0004ff00ff000538045811d72837	rn.......8.X..(7
0x29152	051200001f002501000000bc0280a903	......%.........
0x29162	000d4d532053616e73205365726966ff	..MS Sans Serif.
0x29172	020406000000449d420007000000849a	......D.B.......
0x29182	4200070000003c9a420007000000f499	B.....<.B.......
0x29192	4200500000008c2d5b5eb187564399ff	B.P....-[^..VC..
0x291a2	e82a0ca7a60e00000000000000000000	.*..............
0x291b2	00000000000000000000100200000000	................
0x291c2	00000000000000000000000000000000	................
0x291d2	0000587d0200000000001c1440004c00	..X}........@.L.
0x291e2	00005642352136267662366368732e64	..VB5!6&vb6chs.d
0x291f2	6c6c000000002a000000000000000000	ll....*.........
0x29202	000000000a0004080000000000000000	................
0x29212	00008092420006f8300000ffffff0800	....B...0.......
0x29222	00000100000001000000e90000009491	................
0x29232	420074914200e0134000780000008700	B.t.B...@.x.....
0x29242	00009600000097000000000000000000	................
0x29252	000000e90000000000004b6177616969	..........Kawaii
0x29262	2d556e69636f726e004b61776169692d	-Unicorn.Kawaii-
0x29272	556e69636f726e00005662310000f401	Unicorn..Vb1....
0x29282	0000f897420000000000a09e4200a0b0	....B.......B...
0x29292	4200180a000008c042004612400000c0	B.......B.F.@...
0x292a2	42000000000000000000000000000000	B...............
0x292b2	00000000000000000000000000000000	................
0x292c2	00000000000000000000000000000000	................
0x292d2	00000000000000000000000000000000	................
0x292e2	00000000000000000000000000000000	................
0x292f2	00000000000000000000000000000000	................
0x29302	00000000000000000000000000000000	................
0x29312	00000000000000000000000000000000	................
0x29322	00000000000000000000000000000000	................
0x29332	00000000000000000000000000000000	................
0x29342	00000000000000000000000000000000	................
0x29352	00000000000000000000000000000000	................
0x29362	00000000000000000000000000000000	................
0x29372	00000000000000000000000000000000	................
0x29382	00000000000000000000000000000000	................
0x29392	00000000000000000000000000000000	................

0x7479a	ffffffffffffffffffffffffffffffff	................
0x747aa	ffffffffffff00000100010000150000	................
0x747ba	01002000c87604000100340234000000	.. ..v....4.4...
0x747ca	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0x747da	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0x747ea	0000bd04effe00000100000001000000	................
0x747fa	000000000100000000003f0000000000	..........?.....
0x7480a	00000400000001000000000000000000	................
0x7481a	00000000000094010000000053007400	............S.t.
0x7482a	720069006e006700460069006c006500	r.i.n.g.F.i.l.e.
0x7483a	49006e0066006f000000700100000000	I.n.f.o...p.....
0x7484a	30003800300034003000340042003000	0.8.0.4.0.4.B.0.
0x7485a	00002c000a00010043006f006d007000	..,.....C.o.m.p.
0x7486a	61006e0079004e0061006d0065000000	a.n.y.N.a.m.e...
0x7487a	00005500450046004900000000004000	..U.E.F.I.....@.
0x7488a	1e000100500072006f00640075006300	....P.r.o.d.u.c.
0x7489a	74004e0061006d006500000000004b00	t.N.a.m.e.....K.
0x748aa	610077006100690069002d0055006e00	a.w.a.i.i.-.U.n.
0x748ba	690063006f0072006e00000000002c00	i.c.o.r.n.....,.
0x748ca	0a000100460069006c00650056006500	....F.i.l.e.V.e.
0x748da	7200732d69006f006e00000000003100	r.s-i.o.n.....1.
0x748ea	2e00300030000000000030000a000100	..0.0.....0.....
0x748fa	500072006f0064007500630074005600	P.r.o.d.u.c.t.V.
0x7490a	65007200730069006f006e0000003100	e.r.s.i.o.n...1.
0x7491a	2e00300030000000000040001e000100	..0.0.....@.....
0x7492a	49006e007400650072006e0061006c00	I.n.t.e.r.n.a.l.
0x7493a	4e0061006d00650000004b0061007700	N.a.m.e...K.a.w.
0x7494a	6100690069002d0055006e0069006300	a.i.i.-.U.n.i.c.
0x7495a	6f0072006e0000000000500026000100	o.r.n.....P.&...
0x7496a	4f0072006900670069006e0061006c00	O.r.i.g.i.n.a.l.
0x7497a	460069006c0065006e0061006d006500	F.i.l.e.n.a.m.e.
0x7498a	00004b00610077006100690069002d00	..K.a.w.a.i.i.-.
0x7499a	55006e00690063006f0072006e002e00	U.n.i.c.o.r.n...
0x749aa	65007800650000000000440000000000	e.x.e.....D.....
0x749ba	560061007200460069006c0065004900	V.a.r.F.i.l.e.I.
0x749ca	6e0066006f0000000000240004000000	n.f.o.....$.....
0x749da	5400720061006e0073006c0061007400	T.r.a.n.s.l.a.t.
0x749ea	69006f006e00000000000408b0040000	i.o.n...........
0x749fa	00000000000000000000000000000000	................
0x74a0a	00000000000000000000000000000000	................
0x74a1a	00000000000000000000000000000000	................
0x74a2a	00000000000000000000000000000000	................
0x74a3a	00000000000000000000000000000000	................
0x74a4a	00000000000000000000000000000000	................
0x74a5a	00000000	....

0x298e0	bf10f080b56546dde24ead339966cf11	.....eF..N.3.f..
0x298f0	b70c00aa0060d3935465787431000000	.....`..Text1...
0x29900	2e3dfbfcfaa06810a73808002b3371b5	.=....h..8..+3q.
0x29910	433a5c50726f6772616d2046696c6573	C:\Program Files
0x29920	2028783836295c4d6963726f736f6674	(x86)\Microsoft
0x29930	2056697375616c2053747564696f5c56	Visual Studio\V
0x29940	4239385c5642362e4f4c420056420000	B98\VB6.OLB.VB..
0x29950	00994200000000000600000009000000	..B.............
0x29960	109942004c994200d0c2420000000000	..B.L.B...B.....
0x29970	0000000068706f00da4ead339966cf11	....hpo..N.3.f..
0x29980	b70c00aa0060d3934c6162656c310000	.....`..Label1..
0x29990	3a4fad339966cf11b70c00aa0060d393	:O.3.f.......`..
0x299a0	466f726d000000002a4fad339966cf11	Form....*O.3.f..
0x299b0	b70c00aa0060d39354696d6572320000	.....`..Timer2..
0x299c0	54696d65723100000700000075736572	Timer1......user
0x299d0	333200001b0000005365744c61796572	32......SetLayer
0x299e0	656457696e646f774174747269627574	edWindowAttribut
0x299f0	65730000cc994200d899420000000400	es....B...B.....
0x29a00	d4c242000000000000000000a1dcc242	..B............B
0x29a10	000bc07402ffe068f4994200b8d01240	...t...h..B....@
0x29a20	00ffd0ffe00000000f00000047657457	............GetW
0x29a30	696e646f774c6f6e67410000cc994200	indowLongA....B.
0x29a40	2c9a420000000400e0c2420000000000	,.B.......B.....
0x29a50	00000000a1e8c242000bc07402ffe068	.......B...t...h
0x29a60	3c9a4200b8d0124000ffd0ffe0000000	<.B....@........
0x29a70	0f00000053657457696e646f774c6f6e	....SetWindowLon
0x29a80	67410000cc994200749a420000000400	gA....B.t.B.....
0x29a90	ecc242000000000000000000a1f4c242	..B............B
0x29aa0	000bc07402ffe068849a4200b8d01240	...t...h..B....@
0x29ab0	00ffd0ffe00000000c00500000000000	..........P.....
0x29ac0	00000000233dfbfcfaa06810a7380800	....#=....h..8..
0x29ad0	2b3371b5223dfbfcfaa06810a7380800	+3q."=....h..8..
0x29ae0	2b3371b502000000c49a4200d49a4200	+3q.......B...B.
0x29af0	00000000794fad339966cf11b70c00aa	....yO.3.f......
0x29b00	0060d393020000005c00000008000000	.`......\.......
0x29b10	2e006500780065000000000016000000	..e.x.e.........
0x29b20	04000000010000000000000000007301	..............s.
0x29b30	ffffffff01000000d94ead339966cf11	.........N.3.f..
0x29b40	b70c00aa0060d393120000005c005500	.....`......\.U.
0x29b50	6e00690063006f0072006e002d000000	n.i.c.o.r.n.-...
0x29b60	e14ead339966cf11b70c00aa00600c93	.N.3.f.......`..
0x29b70	5f5f766261467265655374724c697374	__vbaFreeStrList
0x29b80	000000001e00000063006d0064002000	........c.m.d. .
0x29b90	2f0063002000720065006e0061006d00	/.c. .r.e.n.a.m.
0x29ba0	65002000220000000c0000002e006500	e. .".........e.
0x29bb0	78006500220020000000000008000000	x.e.". .........
0x29bc0	2e006400690065000000000056424136	..d.i.e.....VBA6
0x29bd0	2e444c4c000000005f5f766261456e64	.DLL....__vbaEnd

0xfa0	00000000000000000000000000000000	................
0xfb0	00000000000000000000000000000000	................
0xfc0	00000000000000000000000000000000	................
0xfd0	00000000000000000000000000000000	................
0xfe0	00000000000000000000000000000000	................
0xff0	00000000000000000000000000000000	................
0x1000	8693a372f909a372ee6aa4723168a472	...r...r.j.r1h.r
0x1010	8dcca1726272a47288bea072ba02a372	...rbr.r...r...r
0x1020	c39fa1724109a372766aa2723ac3a072	...rA..rvj.r:..r
0x1030	74a2a1726e02a372fec1a17205cda172	t..rn..r...r...r
0x1040	3acda1729d49a272f19fa1720603a372	:..r.I.r...r...r
0x1050	0604a372ee94a372ea62a3727d41a172	...r...r.b.r}A.r
0x1060	749ba07210c4a1726c57a272fda09472	t..r...rlW.r...r
0x1070	f609a3720ac3a1729b05a272879ba072	...r...r...r...r
0x1080	69cea072dc19a2729395a372859aa072	i..r...r...r...r
0x1090	df47a2728906a372ba03a3721375a472	.G.r...r...r.u.r
0x10a0	5057a2725ac6a1724819a2727d69a272	PW.rZ..rH..r}i.r
0x10b0	2b94a37267e8a072103da17237a2a172	+..rg..r.=.r7..r
0x10c0	1856a272ea10a2723a03a3723a04a372	.V.r...r:..r:..r
0x10d0	016ca2726e03a372a9fda272a4359472	.l.rn..r...r.5.r
0x10e0	2f4ea272db76a472c092a372306ca272	/N.r.v.r...r0l.r
0x10f0	edeea2724496a3722198a272134ea272	...rD..r!..r.N.r
0x1100	11dda272ec6ba272af9fa17200000000	...r.k.r...r....
0x1110	21001400aea042000000000000000000	!.....B.........
0x1120	000000002811400008000000059f4200	....(.@.......B.
0x1130	0c9f42001b9f4200679f4200c49f4200	..B...B.g.B...B.
0x1140	d69f42002ea05700a7a0420000000000	..B...W...B.....
0x1150	27001400e0a6420024a74200e8a64200	'.....B.$.B...B.
0x1160	00000000681140000e00000025a14200	....h.@.....%.B.
0x1170	2ca142003ba1420063a14200cca34200	,.B.;.B.c.B...B.
0x1180	f6a342000ea442001da44200b4a44200	..B...B...B...B.
0x1190	56a54200f3a542000ba642001aa64200	V.B...B...B...B.
0x11a0	d9a6420000	..B..

0x3fe7	74616e636549443d22786d702e696964	tanceID="xmp.iid
0x3ff7	3a39343331376562332d373038352d34	:94317eb3-7085-4
0x4007	3434392d383638302d30333065356130	449-8680-030e5a0
0x4017	3839306433222073744576743a776865	890d3" stEvt:whe
0x4027	6e3d22323031382d31322d3032543135	n="2018-12-02T15
0x4037	3a35303a30362b30383a303022207374	:50:06+08:00" st
0x4047	4576743a736f6674776172654167656e	Evt:softwareAgen
0x4057	743d2241646f62652050686f746f73a6	t="Adobe Photos.
0x4067	6f702043432032303138202857696e64	op CC 2018 (Wind
0x4077	6f777329222f3e203c7264663a6c6920	ows)"/> <rdf:li
0x4087	73744576743a616374696f6e3d227361	stEvt:action="sa
0x4097	766564222073744576743a696e737461	ved" stEvt:insta
0x40a7	6e636549443d22786d702e6969643a62	nceID="xmp.iid:b
0x40b7	646133646334622d636165652d666434	da3dc4b-caee-fd4
0x40c7	362d623835662d313139633636353632	6-b85f-119c66562
0x40d7	336566222073744576743a7768656e3d	3ef" stEvt:when=
0x40e7	22323031382d31322d30325431363a30	"2018-12-02T16:0
0x40f7	323a35392b30383a3030222073744576	2:59+08:00" stEv
0x4107	743a736f6674776172654167656e743d	t:softwareAgent=
0x4117	2241646f62652050686f746f73686f70	"Adobe Photoshop
0x4127	2043432032303138202857696e646f77	CC 2018 (Window
0x4137	7329222073744576743a6368616e6765	s)" stEvt:change
0x4147	643d222f222f3e203c7264663a6c6920	d="/"/> <rdf:li
0x4157	73744576743a616374696f6e3d227361	stEvt:action="sa
0x4167	766564222073744576743a696e737461	ved" stEvt:insta
0x4177	6e636549443d22786d702e6969643a64	nceID="xmp.iid:d
0x4187	396437373430312d373132342d656434	9d77401-7124-ed4
0x4197	322d386237312d343031346236353166	2-8b71-4014b651f
0x41a7	393334222073744576743a7768656e3d	934" stEvt:when=
0x41b7	22323031392d30312d30375431393a34	"2019-01-07T19:4
0x41c7	343a32372b30383a3030222073744576	4:27+08:00" stEv
0x41d7	743a736f6674776172654167656e743d	t:softwareAgent=

Objectives

0x0	4d5a90000300000004000000ffff0000	MZ..............
0x10	b8000000000000004000000000000000	........@.......
0x20	00000000000000000000000000000000	................
0x30	000000000000000000000000b8000000	................
0x40	0e1fba0e00b409cd21b8014ccd215468	........!..L.!Th
0x50	69732070726f6772616d2063616e6e6f	is program canno
0x60	742062652072756e20696e20444f5320	t be run in DOS
0x70	6d6f64652e0d0d0a2400000000000000	mode....$.......
0x80	759ff9db31fe978831fe978831fe9788	u...1...1...1...
0x90	b2e2998830fe97887edc9e8830fe9788	....0...~...0...
0xa0	07d89a8830fe97885269636831fe9788	....0...Rich1...
0xb0	0000000000000000504500004c010300	........PE..L...
0xc0	8027435c0000000000000000e0000f01	.'C\............
0xd0	0b01060000b002000090040000000000	................
0xe0	d41300000010000000c0020000004000	..............@.
0xf0	00100000001000000400000001000000	................
0x100	04000000000000000050070000100000	.........P......
0x110	ddd60700020000000000100000100000	................
0x120	00001000	....

0xfa0	00000000000000000000000000000000	................
0xfb0	00000000000000000000000000000000	................
0xfc0	00000000000000000000000000000000	................
0xfd0	00000000000000000000000000000000	................
0xfe0	00000000000000000000000000000000	................
0xff0	00000000000000000000000000000000	................
0x1000	8693a372f909a372ee6aa4723168a472	...r...r.j.r1h.r
0x1010	8dcca1726272a47288bea072ba02a372	...rbr.r...r...r
0x1020	c39fa1724109a372766aa2723ac3a072	...rA..rvj.r:..r
0x1030	74a2a1726e02a372fec1a17205cda172	t..rn..r...r...r
0x1040	3acda1729d49a272f19fa1720603a372	:..r.I.r...r...r
0x1050	0604a372ee94a372ea62a3727d41a172	...r...r.b.r}A.r
0x1060	749ba07210c4a1726c57a272fda09472	t..r...rlW.r...r
0x1070	f609a3720ac3a1729b05a272879ba072	...r...r...r...r
0x1080	69cea072dc19a2729395a372859aa072	i..r...r...r...r
0x1090	df47a2728906a372ba03a3721375a472	.G.r...r...r.u.r
0x10a0	5057a2725ac6a1724819a2727d69a272	PW.rZ..rH..r}i.r
0x10b0	2b94a37267e8a072103da17237a2a172	+..rg..r.=.r7..r
0x10c0	1856a272ea10a2723a03a3723a04a372	.V.r...r:..r:..r
0x10d0	016ca2726e03a372a9fda272a4359472	.l.rn..r...r.5.r
0x10e0	2f4ea272db76a472c092a372306ca272	/N.r.v.r...r0l.r
0x10f0	edeea2724496a3722198a272134ea272	...rD..r!..r.N.r
0x1100	11dda272ec6ba272af9fa17200000000	...r.k.r...r....
0x1110	21001400aea042000000000000000000	!.....B.........
0x1120	000000002811400008000000059f4200	....(.@.......B.
0x1130	0c9f42001b9f4200679f4200c49f4200	..B...B.g.B...B.
0x1140	d69f42002ea05700a7a0420000000000	..B...W...B.....
0x1150	27001400e0a6420024a74200e8a64200	'.....B.$.B...B.
0x1160	00000000681140000e00000025a14200	....h.@.....%.B.
0x1170	2ca142003ba1420063a14200cca34200	,.B.;.B.c.B...B.
0x1180	f6a342000ea442001da44200b4a44200	..B...B...B...B.
0x1190	56a54200f3a542000ba642001aa64200	V.B...B...B...B.
0x11a0	d9a6420000	..B..

0xfa0	00000000000000000000000000000000	................
0xfb0	00000000000000000000000000000000	................
0xfc0	00000000000000000000000000000000	................
0xfd0	00000000000000000000000000000000	................
0xfe0	00000000000000000000000000000000	................
0xff0	00000000000000000000000000000000	................
0x1000	8693a372f909a372ee6aa4723168a472	...r...r.j.r1h.r
0x1010	8dcca1726272a47288bea072ba02a372	...rbr.r...r...r
0x1020	c39fa1724109a372766aa2723ac3a072	...rA..rvj.r:..r
0x1030	74a2a1726e02a372fec1a17205cda172	t..rn..r...r...r
0x1040	3acda1729d49a272f19fa1720603a372	:..r.I.r...r...r
0x1050	0604a372ee94a372ea62a3727d41a172	...r...r.b.r}A.r
0x1060	749ba07210c4a1726c57a272fda09472	t..r...rlW.r...r
0x1070	f609a3720ac3a1729b05a272879ba072	...r...r...r...r
0x1080	69cea072dc19a2729395a372859aa072	i..r...r...r...r
0x1090	df47a2728906a372ba03a3721375a472	.G.r...r...r.u.r
0x10a0	5057a2725ac6a1724819a2727d69a272	PW.rZ..rH..r}i.r
0x10b0	2b94a37267e8a072103da17237a2a172	+..rg..r.=.r7..r
0x10c0	1856a272ea10a2723a03a3723a04a372	.V.r...r:..r:..r
0x10d0	016ca2726e03a372a9fda272a4359472	.l.rn..r...r.5.r
0x10e0	2f4ea272db76a472c092a372306ca272	/N.r.v.r...r0l.r
0x10f0	edeea2724496a3722198a272134ea272	...rD..r!..r.N.r
0x1100	11dda272ec6ba272af9fa17200000000	...r.k.r...r....
0x1110	21001400aea042000000000000000000	!.....B.........
0x1120	000000002811400008000000059f4200	....(.@.......B.
0x1130	0c9f42001b9f4200679f4200c49f4200	..B...B.g.B...B.
0x1140	d69f42002ea05700a7a0420000000000	..B...W...B.....
0x1150	27001400e0a6420024a74200e8a64200	'.....B.$.B...B.
0x1160	00000000681140000e00000025a14200	....h.@.....%.B.
0x1170	2ca142003ba1420063a14200cca34200	,.B.;.B.c.B...B.
0x1180	f6a342000ea442001da44200b4a44200	..B...B...B...B.
0x1190	56a54200f3a542000ba642001aa64200	V.B...B...B...B.
0x11a0	d9a6420000	..B..

Micro-behaviors

0x3b2a	2000500068006f0074006f0073006800	.P.h.o.t.o.s.h.
0x3b3a	6f007000200043004300200032003000	o.p. .C.C. .2.0.
0x3b4a	31003800000001003842494d04060000	1.8.....8BIM....
0x3b5a	000000070008000000010100ffe1117a	...............z
0x3b6a	687474703a2f2f6e732e61646f62652e	http://ns.adobe.
0x3b7a	636f6d2f7861702f312e302f003c3f78	com/xap/1.0/.<?x
0x3b8a	7061636b657420626567696e3d22efbb	packet begin="..
0x3b9a	bf222069643d2257354d304d70436568	." id="W5M0MpCeh
0x3baa	69487a7265537a4e54637a6b63396422	iHzreSzNTczkc9d"
0x3bba	3f3e203c783a786d706d65746120786d	?> <x:xmpmeta xm
0x3bca	6c6e733a783d2261646f62653a6e733a	lns:x="adobe:ns:
0x3bda	6d6574612f2220783a786d70746b3d22	meta/" x:xmptk="
0x3bea	41646f626520584d5020436f72652035	Adobe XMP Core 5
0x3bfa	2e362d63	.6-c

0x4f18	000038f50000039058595a2000000000	..8.....XYZ ....
0x4f28	000062990000b785000018da58595a20	..b.........XYZ
0x4f38	00000000000024a000000f840000b6cf	......$.........
0x4f48	64657363000000000000001649454320	desc........IEC
0x4f58	687474703a2f2f7777772e6965632e63	http://www.iec.c
0x4f68	68000000000000000000000016494543	h............IEC
0x4f78	20687474703a2f2f7777772e6965632e	http://www.iec.
0x4f88	63680000000000000000000000000000	ch..............
0x4f98	00000000000000000000000000000000	................
0x4fa8	00000000000000000000000000000000	................
0x4fb8	64657363000000000000002e49454320	desc........IEC
0x4fc8	36313936362d322e312044656661756c	61966-2.1 Defaul
0x4fd8	742052474220636f6c6f757220737061	t RGB colour spa
0x4fe8	63	c

0x3fe7	74616e636549443d22786d702e696964	tanceID="xmp.iid
0x3ff7	3a39343331376562332d373038352d34	:94317eb3-7085-4
0x4007	3434392d383638302d30333065356130	449-8680-030e5a0
0x4017	3839306433222073744576743a776865	890d3" stEvt:whe
0x4027	6e3d22323031382d31322d3032543135	n="2018-12-02T15
0x4037	3a35303a30362b30383a303022207374	:50:06+08:00" st
0x4047	4576743a736f6674776172654167656e	Evt:softwareAgen
0x4057	743d2241646f62652050686f746f73a6	t="Adobe Photos.
0x4067	6f702043432032303138202857696e64	op CC 2018 (Wind
0x4077	6f777329222f3e203c7264663a6c6920	ows)"/> <rdf:li
0x4087	73744576743a616374696f6e3d227361	stEvt:action="sa
0x4097	766564222073744576743a696e737461	ved" stEvt:insta
0x40a7	6e636549443d22786d702e6969643a62	nceID="xmp.iid:b
0x40b7	646133646334622d636165652d666434	da3dc4b-caee-fd4
0x40c7	362d623835662d313139633636353632	6-b85f-119c66562
0x40d7	336566222073744576743a7768656e3d	3ef" stEvt:when=
0x40e7	22323031382d31322d30325431363a30	"2018-12-02T16:0
0x40f7	323a35392b30383a3030222073744576	2:59+08:00" stEv
0x4107	743a736f6674776172654167656e743d	t:softwareAgent=
0x4117	2241646f62652050686f746f73686f70	"Adobe Photoshop
0x4127	2043432032303138202857696e646f77	CC 2018 (Window
0x4137	7329222073744576743a6368616e6765	s)" stEvt:change
0x4147	643d222f222f3e203c7264663a6c6920	d="/"/> <rdf:li
0x4157	73744576743a616374696f6e3d227361	stEvt:action="sa
0x4167	766564222073744576743a696e737461	ved" stEvt:insta
0x4177	6e636549443d22786d702e6969643a64	nceID="xmp.iid:d
0x4187	396437373430312d373132342d656434	9d77401-7124-ed4
0x4197	322d386237312d343031346236353166	2-8b71-4014b651f
0x41a7	393334222073744576743a7768656e3d	934" stEvt:when=
0x41b7	22323031392d30312d30375431393a34	"2019-01-07T19:4
0x41c7	343a32372b30383a3030222073744576	4:27+08:00" stEv
0x41d7	743a736f6674776172654167656e743d	t:softwareAgent=

0x1460	00000000000000000000000000000000	................
0x1470	0000000000ff7c0200507c0200000700	......\|..P\|.....
0x1480	556e69636f726e000d010b0049276d20	Unicorn.....I'm
0x1490	556e69636f726e000308000080190100	Unicorn.........
0x14a0	420021fd7b02006c740000f57b0200ff	B.!.{..lt...{...
0x14b0	d8ffe10f554578696600004d4d002a00	....UExif..MM.*.
0x14c0	00000800070112000300000001000100	................
0x14d0	00011a00050000000100000062011b00	............b...
0x14e0	05000000010000006a01280003000000	........j.(.....
0x14f0	01000200000131000200000022120000	......1....."...
0x1500	72013200020000001400000094876900	r.2...........i.
0x1510	0400000001000000a8000000d40015f9	................
0x1520	00000027100015f9000000271041646f	...'.......'.Ado
0x1530	62652050686f746f73686f7020434320	be Photoshop CC
0x1540	32303138202857696e646f7773290032	2018 (Windows).2
0x1550	3031393a30313a30372031393a34343a	019:01:07 19:44:
0x1560	3237000003a001000300000001000100	27..............
0x1570	00a002000400000001000002eea00300	................
0x1580	04000000010000032b00000000000000	........+.......
0x1590	06010300030000000100060000011a00	................
0x15a0	050000000100000122011b0005000000	........".......
0x15b0	010000012a0128000300000001000200	....*.(.........
0x15c0	00020100040000000100000132020200	............2...
0x15d0	040000000100000e1b00000000000000	................
0x15e0	48000000010000004800000001ffd8ff	H.......H.......
0x15f0	ed000c41646f62655f434d0001ffee00	...Adobe_CM.....
0x1600	0e41646f626500648000000001ffdb00	.Adobe.d........
0x1610	84000c08080809080c09090c110b0a0b	................
0x1620	11150f0c0c0f1518131315131318110c	................
0x1630	0c0c0c0c0c110c0c0c0c0c0c0c0c0c0c	................
0x1640	0c0c0c0c0c0c0c0c0c0c0c0c0c0c	..............

0x3d37	61702f312e302f6d6d2f2220786d6c6e	ap/1.0/mm/" xmln
0x3d47	733a73744576743d22687474703a2f2f	s:stEvt="http://
0x3d57	6e732e61646f62652e636f6d2f786170	ns.adobe.com/xap
0x3d67	2f312e302f73547970652f5265736f75	/1.0/sType/Resou
0x3d77	7263654576656e74232220786d6c6e73	rceEvent#" xmlns
0x3d87	3a73745265663d22687474703a2f2f6e	:stRef="http://n
0x3d97	732e61646f62652e636f6d2f7861702f	s.adobe.com/xap/
0x3da7	312e302f73547970652f5265736f75f3	1.0/sType/Resou.
0x3db7	6365526566232220786d703a43726561	ceRef#" xmp:Crea
0x3dc7	746f72546f6f6c3d2241646f62652050	torTool="Adobe P
0x3dd7	686f746f73686f702043432032303138	hotoshop CC 2018
0x3de7	202857696e646f7773292220786d703a	(Windows)" xmp:
0x3df7	437265617465446174653d2232303138	CreateDate="2018
0x3e07	2d31322d30325431353a35303a30362b	-12-02T15:50:06+
0x3e17	30383a30302220786d703a4d6f646966	08:00" xmp:Modif
0x3e27	79446174653d22323031392d30312d30	yDate="2019-01-0
0x3e37	375431393a34343a32372b30383a3030	7T19:44:27+08:00
0x3e47	2220786d703a4d8c7461646174614461	" xmp:M.tadataDa
0x3e57	74653d22323031392d30312d303754a4	te="2019-01-07T.
0x3e67	393a34343a32372b30383a3030222064	9:44:27+08:00" d
0x3e77	633a666f726d61743d22696d6167652f	c:format="image/
0x3e87	6a706567222070686f746f73686f703a	jpeg" photoshop:
0x3e97	436f6c6f724d6f64653d223322207068	ColorMode="3" ph
0x3ea7	6f746f73686f703a49434350726f6669	otoshop:ICCProfi
0x3eb7	6c653d22735247422049454336313936	le="sRGB IEC6196
0x3ec7	362d322e312220786d704d4d3a496e73	6-2.1" xmpMM:Ins
0x3ed7	74616e636549443d22786d702e696964	tanceID="xmp.iid
0x3ee7	3a64353937343839392d636138382d37	:d5974899-ca88-7
0x3ef7	6634322d393531362d38653736333538	f42-9516-8e76358
0x3f07	30386466332220786d704d4d3a446f63	08df3" xmpMM:Doc
0x3f17	756d656e7449443d2261646f62653a64	umentID="adobe:d
0x3f27	6f6369643a70686f746f73686f703a39	ocid:photoshop:9

0xfa0	00000000000000000000000000000000	................
0xfb0	00000000000000000000000000000000	................
0xfc0	00000000000000000000000000000000	................
0xfd0	00000000000000000000000000000000	................
0xfe0	00000000000000000000000000000000	................
0xff0	00000000000000000000000000000000	................
0x1000	8693a372f909a372ee6aa4723168a472	...r...r.j.r1h.r
0x1010	8dcca1726272a47288bea072ba02a372	...rbr.r...r...r
0x1020	c39fa1724109a372766aa2723ac3a072	...rA..rvj.r:..r
0x1030	74a2a1726e02a372fec1a17205cda172	t..rn..r...r...r
0x1040	3acda1729d49a272f19fa1720603a372	:..r.I.r...r...r
0x1050	0604a372ee94a372ea62a3727d41a172	...r...r.b.r}A.r
0x1060	749ba07210c4a1726c57a272fda09472	t..r...rlW.r...r
0x1070	f609a3720ac3a1729b05a272879ba072	...r...r...r...r
0x1080	69cea072dc19a2729395a372859aa072	i..r...r...r...r
0x1090	df47a2728906a372ba03a3721375a472	.G.r...r...r.u.r
0x10a0	5057a2725ac6a1724819a2727d69a272	PW.rZ..rH..r}i.r
0x10b0	2b94a37267e8a072103da17237a2a172	+..rg..r.=.r7..r
0x10c0	1856a272ea10a2723a03a3723a04a372	.V.r...r:..r:..r
0x10d0	016ca2726e03a372a9fda272a4359472	.l.rn..r...r.5.r
0x10e0	2f4ea272db76a472c092a372306ca272	/N.r.v.r...r0l.r
0x10f0	edeea2724496a3722198a272134ea272	...rD..r!..r.N.r
0x1100	11dda272ec6ba272af9fa17200000000	...r.k.r...r....
0x1110	21001400aea042000000000000000000	!.....B.........
0x1120	000000002811400008000000059f4200	....(.@.......B.
0x1130	0c9f42001b9f4200679f4200c49f4200	..B...B.g.B...B.
0x1140	d69f42002ea05700a7a0420000000000	..B...W...B.....
0x1150	27001400e0a6420024a74200e8a64200	'.....B.$.B...B.
0x1160	00000000681140000e00000025a14200	....h.@.....%.B.
0x1170	2ca142003ba1420063a14200cca34200	,.B.;.B.c.B...B.
0x1180	f6a342000ea442001da44200b4a44200	..B...B...B...B.
0x1190	56a54200f3a542000ba642001aa64200	V.B...B...B...B.
0x11a0	d9a6420000	..B..

0xfa0	00000000000000000000000000000000	................
0xfb0	00000000000000000000000000000000	................
0xfc0	00000000000000000000000000000000	................
0xfd0	00000000000000000000000000000000	................
0xfe0	00000000000000000000000000000000	................
0xff0	00000000000000000000000000000000	................
0x1000	8693a372f909a372ee6aa4723168a472	...r...r.j.r1h.r
0x1010	8dcca1726272a47288bea072ba02a372	...rbr.r...r...r
0x1020	c39fa1724109a372766aa2723ac3a072	...rA..rvj.r:..r
0x1030	74a2a1726e02a372fec1a17205cda172	t..rn..r...r...r
0x1040	3acda1729d49a272f19fa1720603a372	:..r.I.r...r...r
0x1050	0604a372ee94a372ea62a3727d41a172	...r...r.b.r}A.r
0x1060	749ba07210c4a1726c57a272fda09472	t..r...rlW.r...r
0x1070	f609a3720ac3a1729b05a272879ba072	...r...r...r...r
0x1080	69cea072dc19a2729395a372859aa072	i..r...r...r...r
0x1090	df47a2728906a372ba03a3721375a472	.G.r...r...r.u.r
0x10a0	5057a2725ac6a1724819a2727d69a272	PW.rZ..rH..r}i.r
0x10b0	2b94a37267e8a072103da17237a2a172	+..rg..r.=.r7..r
0x10c0	1856a272ea10a2723a03a3723a04a372	.V.r...r:..r:..r
0x10d0	016ca2726e03a372a9fda272a4359472	.l.rn..r...r.5.r
0x10e0	2f4ea272db76a472c092a372306ca272	/N.r.v.r...r0l.r
0x10f0	edeea2724496a3722198a272134ea272	...rD..r!..r.N.r
0x1100	11dda272ec6ba272af9fa17200000000	...r.k.r...r....
0x1110	21001400aea042000000000000000000	!.....B.........
0x1120	000000002811400008000000059f4200	....(.@.......B.
0x1130	0c9f42001b9f4200679f4200c49f4200	..B...B.g.B...B.
0x1140	d69f42002ea05700a7a0420000000000	..B...W...B.....
0x1150	27001400e0a6420024a74200e8a64200	'.....B.$.B...B.
0x1160	00000000681140000e00000025a14200	....h.@.....%.B.
0x1170	2ca142003ba1420063a14200cca34200	,.B.;.B.c.B...B.
0x1180	f6a342000ea442001da44200b4a44200	..B...B...B...B.
0x1190	56a54200f3a542000ba642001aa64200	V.B...B...B...B.
0x11a0	d9a6420000	..B..

0x298e0	bf10f080b56546dde24ead339966cf11	.....eF..N.3.f..
0x298f0	b70c00aa0060d3935465787431000000	.....`..Text1...
0x29900	2e3dfbfcfaa06810a73808002b3371b5	.=....h..8..+3q.
0x29910	433a5c50726f6772616d2046696c6573	C:\Program Files
0x29920	2028783836295c4d6963726f736f6674	(x86)\Microsoft
0x29930	2056697375616c2053747564696f5c56	Visual Studio\V
0x29940	4239385c5642362e4f4c420056420000	B98\VB6.OLB.VB..
0x29950	00994200000000000600000009000000	..B.............
0x29960	109942004c994200d0c2420000000000	..B.L.B...B.....
0x29970	0000000068706f00da4ead339966cf11	....hpo..N.3.f..
0x29980	b70c00aa0060d3934c6162656c310000	.....`..Label1..
0x29990	3a4fad339966cf11b70c00aa0060d393	:O.3.f.......`..
0x299a0	466f726d000000002a4fad339966cf11	Form....*O.3.f..
0x299b0	b70c00aa0060d39354696d6572320000	.....`..Timer2..
0x299c0	54696d65723100000700000075736572	Timer1......user
0x299d0	333200001b0000005365744c61796572	32......SetLayer
0x299e0	656457696e646f774174747269627574	edWindowAttribut
0x299f0	65730000cc994200d899420000000400	es....B...B.....
0x29a00	d4c242000000000000000000a1dcc242	..B............B
0x29a10	000bc07402ffe068f4994200b8d01240	...t...h..B....@
0x29a20	00ffd0ffe00000000f00000047657457	............GetW
0x29a30	696e646f774c6f6e67410000cc994200	indowLongA....B.
0x29a40	2c9a420000000400e0c2420000000000	,.B.......B.....
0x29a50	00000000a1e8c242000bc07402ffe068	.......B...t...h
0x29a60	3c9a4200b8d0124000ffd0ffe0000000	<.B....@........
0x29a70	0f00000053657457696e646f774c6f6e	....SetWindowLon
0x29a80	67410000cc994200749a420000000400	gA....B.t.B.....
0x29a90	ecc242000000000000000000a1f4c242	..B............B
0x29aa0	000bc07402ffe068849a4200b8d01240	...t...h..B....@
0x29ab0	00ffd0ffe00000000c00500000000000	..........P.....
0x29ac0	00000000233dfbfcfaa06810a7380800	....#=....h..8..
0x29ad0	2b3371b5223dfbfcfaa06810a7380800	+3q."=....h..8..
0x29ae0	2b3371b502000000c49a4200d49a4200	+3q.......B...B.
0x29af0	00000000794fad339966cf11b70c00aa	....yO.3.f......
0x29b00	0060d393020000005c00000008000000	.`......\.......
0x29b10	2e006500780065000000000016000000	..e.x.e.........
0x29b20	04000000010000000000000000007301	..............s.
0x29b30	ffffffff01000000d94ead339966cf11	.........N.3.f..
0x29b40	b70c00aa0060d393120000005c005500	.....`......\.U.
0x29b50	6e00690063006f0072006e002d000000	n.i.c.o.r.n.-...
0x29b60	e14ead339966cf11b70c00aa00600c93	.N.3.f.......`..
0x29b70	5f5f766261467265655374724c697374	__vbaFreeStrList
0x29b80	000000001e00000063006d0064002000	........c.m.d. .
0x29b90	2f0063002000720065006e0061006d00	/.c. .r.e.n.a.m.
0x29ba0	65002000220000000c0000002e006500	e. .".........e.
0x29bb0	78006500220020000000000008000000	x.e.". .........
0x29bc0	2e006400690065000000000056424136	..d.i.e.....VBA6
0x29bd0	2e444c4c000000005f5f766261456e64	.DLL....__vbaEnd

0xfa0	00000000000000000000000000000000	................
0xfb0	00000000000000000000000000000000	................
0xfc0	00000000000000000000000000000000	................
0xfd0	00000000000000000000000000000000	................
0xfe0	00000000000000000000000000000000	................
0xff0	00000000000000000000000000000000	................
0x1000	8693a372f909a372ee6aa4723168a472	...r...r.j.r1h.r
0x1010	8dcca1726272a47288bea072ba02a372	...rbr.r...r...r
0x1020	c39fa1724109a372766aa2723ac3a072	...rA..rvj.r:..r
0x1030	74a2a1726e02a372fec1a17205cda172	t..rn..r...r...r
0x1040	3acda1729d49a272f19fa1720603a372	:..r.I.r...r...r
0x1050	0604a372ee94a372ea62a3727d41a172	...r...r.b.r}A.r
0x1060	749ba07210c4a1726c57a272fda09472	t..r...rlW.r...r
0x1070	f609a3720ac3a1729b05a272879ba072	...r...r...r...r
0x1080	69cea072dc19a2729395a372859aa072	i..r...r...r...r
0x1090	df47a2728906a372ba03a3721375a472	.G.r...r...r.u.r
0x10a0	5057a2725ac6a1724819a2727d69a272	PW.rZ..rH..r}i.r
0x10b0	2b94a37267e8a072103da17237a2a172	+..rg..r.=.r7..r
0x10c0	1856a272ea10a2723a03a3723a04a372	.V.r...r:..r:..r
0x10d0	016ca2726e03a372a9fda272a4359472	.l.rn..r...r.5.r
0x10e0	2f4ea272db76a472c092a372306ca272	/N.r.v.r...r0l.r
0x10f0	edeea2724496a3722198a272134ea272	...rD..r!..r.N.r
0x1100	11dda272ec6ba272af9fa17200000000	...r.k.r...r....
0x1110	21001400aea042000000000000000000	!.....B.........
0x1120	000000002811400008000000059f4200	....(.@.......B.
0x1130	0c9f42001b9f4200679f4200c49f4200	..B...B.g.B...B.
0x1140	d69f42002ea05700a7a0420000000000	..B...W...B.....
0x1150	27001400e0a6420024a74200e8a64200	'.....B.$.B...B.
0x1160	00000000681140000e00000025a14200	....h.@.....%.B.
0x1170	2ca142003ba1420063a14200cca34200	,.B.;.B.c.B...B.
0x1180	f6a342000ea442001da44200b4a44200	..B...B...B...B.
0x1190	56a54200f3a542000ba642001aa64200	V.B...B...B...B.
0x11a0	d9a6420000	..B..

0x290b2	00350000000000000000d42b0000e727	.5.........+...'
0x290c2	000044004601ff011f00000001060054	..D.F..........T
0x290d2	696d657232000b032823000007702600	imer2...(#...p&.
0x290e2	000890150000ff032000000002050054	........ ......T
0x290f2	65787431000204c003d00267021d010b	ext1.......g....
0x29102	01003000120100ff031f000000030600	..0.............
0x29112	54696d657231000b03b80b000007c021	Timer1.........!
0x29122	000008f8070000ff0347000000040600	.........G......
0x29132	4c6162656c310001010700556e69636f	Label1.....Unico
0x29142	726e0004ff00ff000538045811d72837	rn.......8.X..(7
0x29152	051200001f002501000000bc0280a903	......%.........
0x29162	000d4d532053616e73205365726966ff	..MS Sans Serif.
0x29172	020406000000449d420007000000849a	......D.B.......
0x29182	4200070000003c9a420007000000f499	B.....<.B.......
0x29192	4200500000008c2d5b5eb187564399ff	B.P....-[^..VC..
0x291a2	e82a0ca7a60e00000000000000000000	.*..............
0x291b2	00000000000000000000100200000000	................
0x291c2	00000000000000000000000000000000	................
0x291d2	0000587d0200000000001c1440004c00	..X}........@.L.
0x291e2	00005642352136267662366368732e64	..VB5!6&vb6chs.d
0x291f2	6c6c000000002a000000000000000000	ll....*.........
0x29202	000000000a0004080000000000000000	................
0x29212	00008092420006f8300000ffffff0800	....B...0.......
0x29222	00000100000001000000e90000009491	................
0x29232	420074914200e0134000780000008700	B.t.B...@.x.....
0x29242	00009600000097000000000000000000	................
0x29252	000000e90000000000004b6177616969	..........Kawaii
0x29262	2d556e69636f726e004b61776169692d	-Unicorn.Kawaii-
0x29272	556e69636f726e00005662310000f401	Unicorn..Vb1....
0x29282	0000f897420000000000a09e4200a0b0	....B.......B...
0x29292	4200180a000008c042004612400000c0	B.......B.F.@...
0x292a2	42000000000000000000000000000000	B...............
0x292b2	00000000000000000000000000000000	................
0x292c2	00000000000000000000000000000000	................
0x292d2	00000000000000000000000000000000	................
0x292e2	00000000000000000000000000000000	................
0x292f2	00000000000000000000000000000000	................
0x29302	00000000000000000000000000000000	................
0x29312	00000000000000000000000000000000	................
0x29322	00000000000000000000000000000000	................
0x29332	00000000000000000000000000000000	................
0x29342	00000000000000000000000000000000	................
0x29352	00000000000000000000000000000000	................
0x29362	00000000000000000000000000000000	................
0x29372	00000000000000000000000000000000	................
0x29382	00000000000000000000000000000000	................
0x29392	00000000000000000000000000000000	................

0x298e0	bf10f080b56546dde24ead339966cf11	.....eF..N.3.f..
0x298f0	b70c00aa0060d3935465787431000000	.....`..Text1...
0x29900	2e3dfbfcfaa06810a73808002b3371b5	.=....h..8..+3q.
0x29910	433a5c50726f6772616d2046696c6573	C:\Program Files
0x29920	2028783836295c4d6963726f736f6674	(x86)\Microsoft
0x29930	2056697375616c2053747564696f5c56	Visual Studio\V
0x29940	4239385c5642362e4f4c420056420000	B98\VB6.OLB.VB..
0x29950	00994200000000000600000009000000	..B.............
0x29960	109942004c994200d0c2420000000000	..B.L.B...B.....
0x29970	0000000068706f00da4ead339966cf11	....hpo..N.3.f..
0x29980	b70c00aa0060d3934c6162656c310000	.....`..Label1..
0x29990	3a4fad339966cf11b70c00aa0060d393	:O.3.f.......`..
0x299a0	466f726d000000002a4fad339966cf11	Form....*O.3.f..
0x299b0	b70c00aa0060d39354696d6572320000	.....`..Timer2..
0x299c0	54696d65723100000700000075736572	Timer1......user
0x299d0	333200001b0000005365744c61796572	32......SetLayer
0x299e0	656457696e646f774174747269627574	edWindowAttribut
0x299f0	65730000cc994200d899420000000400	es....B...B.....
0x29a00	d4c242000000000000000000a1dcc242	..B............B
0x29a10	000bc07402ffe068f4994200b8d01240	...t...h..B....@
0x29a20	00ffd0ffe00000000f00000047657457	............GetW
0x29a30	696e646f774c6f6e67410000cc994200	indowLongA....B.
0x29a40	2c9a420000000400e0c2420000000000	,.B.......B.....
0x29a50	00000000a1e8c242000bc07402ffe068	.......B...t...h
0x29a60	3c9a4200b8d0124000ffd0ffe0000000	<.B....@........
0x29a70	0f00000053657457696e646f774c6f6e	....SetWindowLon
0x29a80	67410000cc994200749a420000000400	gA....B.t.B.....
0x29a90	ecc242000000000000000000a1f4c242	..B............B
0x29aa0	000bc07402ffe068849a4200b8d01240	...t...h..B....@
0x29ab0	00ffd0ffe00000000c00500000000000	..........P.....
0x29ac0	00000000233dfbfcfaa06810a7380800	....#=....h..8..
0x29ad0	2b3371b5223dfbfcfaa06810a7380800	+3q."=....h..8..
0x29ae0	2b3371b502000000c49a4200d49a4200	+3q.......B...B.
0x29af0	00000000794fad339966cf11b70c00aa	....yO.3.f......
0x29b00	0060d393020000005c00000008000000	.`......\.......
0x29b10	2e006500780065000000000016000000	..e.x.e.........
0x29b20	04000000010000000000000000007301	..............s.
0x29b30	ffffffff01000000d94ead339966cf11	.........N.3.f..
0x29b40	b70c00aa0060d393120000005c005500	.....`......\.U.
0x29b50	6e00690063006f0072006e002d000000	n.i.c.o.r.n.-...
0x29b60	e14ead339966cf11b70c00aa00600c93	.N.3.f.......`..
0x29b70	5f5f766261467265655374724c697374	__vbaFreeStrList
0x29b80	000000001e00000063006d0064002000	........c.m.d. .
0x29b90	2f0063002000720065006e0061006d00	/.c. .r.e.n.a.m.
0x29ba0	65002000220000000c0000002e006500	e. .".........e.
0x29bb0	78006500220020000000000008000000	x.e.". .........
0x29bc0	2e006400690065000000000056424136	..d.i.e.....VBA6
0x29bd0	2e444c4c000000005f5f766261456e64	.DLL....__vbaEnd

0xfa0	00000000000000000000000000000000	................
0xfb0	00000000000000000000000000000000	................
0xfc0	00000000000000000000000000000000	................
0xfd0	00000000000000000000000000000000	................
0xfe0	00000000000000000000000000000000	................
0xff0	00000000000000000000000000000000	................
0x1000	8693a372f909a372ee6aa4723168a472	...r...r.j.r1h.r
0x1010	8dcca1726272a47288bea072ba02a372	...rbr.r...r...r
0x1020	c39fa1724109a372766aa2723ac3a072	...rA..rvj.r:..r
0x1030	74a2a1726e02a372fec1a17205cda172	t..rn..r...r...r
0x1040	3acda1729d49a272f19fa1720603a372	:..r.I.r...r...r
0x1050	0604a372ee94a372ea62a3727d41a172	...r...r.b.r}A.r
0x1060	749ba07210c4a1726c57a272fda09472	t..r...rlW.r...r
0x1070	f609a3720ac3a1729b05a272879ba072	...r...r...r...r
0x1080	69cea072dc19a2729395a372859aa072	i..r...r...r...r
0x1090	df47a2728906a372ba03a3721375a472	.G.r...r...r.u.r
0x10a0	5057a2725ac6a1724819a2727d69a272	PW.rZ..rH..r}i.r
0x10b0	2b94a37267e8a072103da17237a2a172	+..rg..r.=.r7..r
0x10c0	1856a272ea10a2723a03a3723a04a372	.V.r...r:..r:..r
0x10d0	016ca2726e03a372a9fda272a4359472	.l.rn..r...r.5.r
0x10e0	2f4ea272db76a472c092a372306ca272	/N.r.v.r...r0l.r
0x10f0	edeea2724496a3722198a272134ea272	...rD..r!..r.N.r
0x1100	11dda272ec6ba272af9fa17200000000	...r.k.r...r....
0x1110	21001400aea042000000000000000000	!.....B.........
0x1120	000000002811400008000000059f4200	....(.@.......B.
0x1130	0c9f42001b9f4200679f4200c49f4200	..B...B.g.B...B.
0x1140	d69f42002ea05700a7a0420000000000	..B...W...B.....
0x1150	27001400e0a6420024a74200e8a64200	'.....B.$.B...B.
0x1160	00000000681140000e00000025a14200	....h.@.....%.B.
0x1170	2ca142003ba1420063a14200cca34200	,.B.;.B.c.B...B.
0x1180	f6a342000ea442001da44200b4a44200	..B...B...B...B.
0x1190	56a54200f3a542000ba642001aa64200	V.B...B...B...B.
0x11a0	d9a6420000	..B..

Metadata

0xfa0	00000000000000000000000000000000	................
0xfb0	00000000000000000000000000000000	................
0xfc0	00000000000000000000000000000000	................
0xfd0	00000000000000000000000000000000	................
0xfe0	00000000000000000000000000000000	................
0xff0	00000000000000000000000000000000	................
0x1000	8693a372f909a372ee6aa4723168a472	...r...r.j.r1h.r
0x1010	8dcca1726272a47288bea072ba02a372	...rbr.r...r...r
0x1020	c39fa1724109a372766aa2723ac3a072	...rA..rvj.r:..r
0x1030	74a2a1726e02a372fec1a17205cda172	t..rn..r...r...r
0x1040	3acda1729d49a272f19fa1720603a372	:..r.I.r...r...r
0x1050	0604a372ee94a372ea62a3727d41a172	...r...r.b.r}A.r
0x1060	749ba07210c4a1726c57a272fda09472	t..r...rlW.r...r
0x1070	f609a3720ac3a1729b05a272879ba072	...r...r...r...r
0x1080	69cea072dc19a2729395a372859aa072	i..r...r...r...r
0x1090	df47a2728906a372ba03a3721375a472	.G.r...r...r.u.r
0x10a0	5057a2725ac6a1724819a2727d69a272	PW.rZ..rH..r}i.r
0x10b0	2b94a37267e8a072103da17237a2a172	+..rg..r.=.r7..r
0x10c0	1856a272ea10a2723a03a3723a04a372	.V.r...r:..r:..r
0x10d0	016ca2726e03a372a9fda272a4359472	.l.rn..r...r.5.r
0x10e0	2f4ea272db76a472c092a372306ca272	/N.r.v.r...r0l.r
0x10f0	edeea2724496a3722198a272134ea272	...rD..r!..r.N.r
0x1100	11dda272ec6ba272af9fa17200000000	...r.k.r...r....
0x1110	21001400aea042000000000000000000	!.....B.........
0x1120	000000002811400008000000059f4200	....(.@.......B.
0x1130	0c9f42001b9f4200679f4200c49f4200	..B...B.g.B...B.
0x1140	d69f42002ea05700a7a0420000000000	..B...W...B.....
0x1150	27001400e0a6420024a74200e8a64200	'.....B.$.B...B.
0x1160	00000000681140000e00000025a14200	....h.@.....%.B.
0x1170	2ca142003ba1420063a14200cca34200	,.B.;.B.c.B...B.
0x1180	f6a342000ea442001da44200b4a44200	..B...B...B...B.
0x1190	56a54200f3a542000ba642001aa64200	V.B...B...B...B.
0x11a0	d9a6420000	..B..

0xfa0	00000000000000000000000000000000	................
0xfb0	00000000000000000000000000000000	................
0xfc0	00000000000000000000000000000000	................
0xfd0	00000000000000000000000000000000	................
0xfe0	00000000000000000000000000000000	................
0xff0	00000000000000000000000000000000	................
0x1000	8693a372f909a372ee6aa4723168a472	...r...r.j.r1h.r
0x1010	8dcca1726272a47288bea072ba02a372	...rbr.r...r...r
0x1020	c39fa1724109a372766aa2723ac3a072	...rA..rvj.r:..r
0x1030	74a2a1726e02a372fec1a17205cda172	t..rn..r...r...r
0x1040	3acda1729d49a272f19fa1720603a372	:..r.I.r...r...r
0x1050	0604a372ee94a372ea62a3727d41a172	...r...r.b.r}A.r
0x1060	749ba07210c4a1726c57a272fda09472	t..r...rlW.r...r
0x1070	f609a3720ac3a1729b05a272879ba072	...r...r...r...r
0x1080	69cea072dc19a2729395a372859aa072	i..r...r...r...r
0x1090	df47a2728906a372ba03a3721375a472	.G.r...r...r.u.r
0x10a0	5057a2725ac6a1724819a2727d69a272	PW.rZ..rH..r}i.r
0x10b0	2b94a37267e8a072103da17237a2a172	+..rg..r.=.r7..r
0x10c0	1856a272ea10a2723a03a3723a04a372	.V.r...r:..r:..r
0x10d0	016ca2726e03a372a9fda272a4359472	.l.rn..r...r.5.r
0x10e0	2f4ea272db76a472c092a372306ca272	/N.r.v.r...r0l.r
0x10f0	edeea2724496a3722198a272134ea272	...rD..r!..r.N.r
0x1100	11dda272ec6ba272af9fa17200000000	...r.k.r...r....
0x1110	21001400aea042000000000000000000	!.....B.........
0x1120	000000002811400008000000059f4200	....(.@.......B.
0x1130	0c9f42001b9f4200679f4200c49f4200	..B...B.g.B...B.
0x1140	d69f42002ea05700a7a0420000000000	..B...W...B.....
0x1150	27001400e0a6420024a74200e8a64200	'.....B.$.B...B.
0x1160	00000000681140000e00000025a14200	....h.@.....%.B.
0x1170	2ca142003ba1420063a14200cca34200	,.B.;.B.c.B...B.
0x1180	f6a342000ea442001da44200b4a44200	..B...B...B...B.
0x1190	56a54200f3a542000ba642001aa64200	V.B...B...B...B.
0x11a0	d9a6420000	..B..

build PE carries bound import descriptors

0x14380	4522d08661fb09ff0057d99e8fe2f8a9	E"..a....W......
0x14390	d4697fb5fec3fe23d975993a9a43c0f4	.i.....#.u.:.C..
0x143a0	75164d3aee392e2dfec7eef7b1edf272	u.M:.9.-.......r
0x143b0	4f4cbad7a50d1cbc5bfde3fe20ff00c4	OL......[... ...
0x143c0	7bba1219738af489d6b9eaa7b756dd9f	{...s........V..
0x143d0	aafbd3b3b6252f820c46e0aaff004c7b	.....%/..F....L{
0x143e0	37fea037712377633fc2fbe31157fec2	7..7q#wc?....W..
0x143f0	b7dcbdcbd782e214d62ac3047d98fe63	.........*..}..c
0x14400	3f611d563606bebd0abb03764381eccd	?a.V6......vC...
0x14410	ab9197f621a8a5ff00e4a7f07cbffafc	....!.......\|...
0x14420	e5bda3e64b5f151e8be5d22bc4ae7ab3	....K_.....+..z.
0x14430	2047b8c34e93aab8e8a48231d777f7b0	G..N......1.w..
0x14440	41e1d6baeaff00ef3edb75a3020f4a53	A.......>.u...JS
0x14450	e11d124f909b7a0c767ce621f3d09afa	...O..z.v\|.!....
0x14460	5fe274f91c7558a2c8d0e471014ff12c	_.t..uX....q.O.,
0x14470	5589b30523d8e79799658b430a9e1ebc	U...#....e.C....
0x14480	7edf974b62a107a57f46fc87c76f5921	~..Kb....F...oY!
0x14490	d95b9eb3edf7a53d2834d5551fe4343b	.[.....=(4.U..4;
0x144a0	bf1f750327891a5bedcc1e75507057fd	..u.'..[...uPpW.
0x144b0	e916fdcbd7365aa68e2a44738f2ffa17	.....6Z..*Ds./..
0x144c0	ccfa7d9c1992d740ad3a356ca1bfdf7f	..}....@.:5l....
0x144d0	bebfb061ba9203a648c9f9f491e668d8	...a....H.....h.
0x144e0	8071d72fc7b59c402474d74d599c4e37	.q./...@$t.MY.N7
0x144f0	3f8bc8e1f334905761f2d495d8cc9e3e	?....4.Wa......>
0x14500	a6c68ab2832b706f71f9536ff627dd50	.....+poq.So.'.P
0x14510	94652a72287f675b5f897d2bd53bed8f	.e*r(.g[_.}+.;..
0x14520	8e3f256bbb137d51537676c7c54dd355	.?%k..}QSvv..M.U
0x14530	470380da7fddfcb57677b7f67e5f1633	G.......vw..~_.3
0x14540	1b47747616ed39d030a4deaf1ffee3b1	.Gtv..9.0.......
0x14550	97fe2945567efed7a2f63afdfa9e1c41	..)EV~....:....A
0x14560	98e8614ff371f23fb7ce940483669015	..aO.q.?.....f..
0x14570	02b93d593f48f6462774ed81b727a66d	..=Y?H.F't...'.m
0x14580	bbbe763d3e2f07be76cf4e40d9bdbb90	..v=>/..v.N@....
0x14590	60ab721897ca6133c52f8bc8005728be	`.r...a3./...W(.
0x145a0	a049d4005b718ccb3c9254e863ebf2fd	.I..[q..<.T.c...
0x145b0	b8a127c82e4798e90c8b5c13423a1d78	..'..G....\.B:.x
0x145c0	fadbd97162b8a63a4f53c2bd7448f7a3	...qb..:OS..tH..
0x145d0	1ac8431e1d6c127cfa0ef786dfa49b21	..C..l.\|.......!
0x145e0	83df549450556e9ebe398cbe224d3426	..T.PUn..9.."M4&
0x145f0	4aec6e530c60dc3835cbd7aa4542994a	J.nS.`.85...EB.J
0x14600	78a189a7d40c421a76375055b4f529a0	x.....B.v7PU..).
0x14610	f0ff002d7d3e7c7edaf577f81b1d0c51	...-}>\|~..w....Q
0x14620	491cd1c7344eb2452a2491ba9babc6ea	I...4N.E*$......
0x14630	191d4fe5594823da2e92f5cfdfbaf75e	..O.YH#........^
0x14640	f7eebdd7bdfbaf75ef7eebdd7bdfbaf7	.......u.~..{...
0x14650	5ef7eebdd7bdfbaf75ef7eebdd7bdfba	^.......u.~..{..
0x14660	f75ef7eebdd7bdfbaf75ef7eebdd7bdf	.^.......u.~..{.
0x14670	baf75ef7eebdd7bdfbaf75ef7eebdd7b	..^.......u.~..{

0x0	4d5a90000300000004000000ffff0000	MZ..............
0x10	b8000000000000004000000000000000	........@.......
0x20	00000000000000000000000000000000	................
0x30	000000000000000000000000b8000000	................
0x40	0e1fba0e00b409cd21b8014ccd215468	........!..L.!Th
0x50	69732070726f6772616d2063616e6e6f	is program canno
0x60	742062652072756e20696e20444f5320	t be run in DOS
0x70	6d6f64652e0d0d0a2400000000000000	mode....$.......
0x80	759ff9db31fe978831fe978831fe9788	u...1...1...1...
0x90	b2e2998830fe97887edc9e8830fe9788	....0...~...0...
0xa0	07d89a8830fe97885269636831fe9788	....0...Rich1...
0xb0	0000000000000000504500004c010300	........PE..L...
0xc0	8027435c0000000000000000e0000f01	.'C\............
0xd0	0b01060000b002000090040000000000	................
0xe0	d41300000010000000c0020000004000	..............@.
0xf0	00100000001000000400000001000000	................
0x100	04000000000000000050070000100000	.........P......
0x110	ddd60700020000000000100000100000	................
0x120	00001000	....

0x298e0	bf10f080b56546dde24ead339966cf11	.....eF..N.3.f..
0x298f0	b70c00aa0060d3935465787431000000	.....`..Text1...
0x29900	2e3dfbfcfaa06810a73808002b3371b5	.=....h..8..+3q.
0x29910	433a5c50726f6772616d2046696c6573	C:\Program Files
0x29920	2028783836295c4d6963726f736f6674	(x86)\Microsoft
0x29930	2056697375616c2053747564696f5c56	Visual Studio\V
0x29940	4239385c5642362e4f4c420056420000	B98\VB6.OLB.VB..
0x29950	00994200000000000600000009000000	..B.............
0x29960	109942004c994200d0c2420000000000	..B.L.B...B.....
0x29970	0000000068706f00da4ead339966cf11	....hpo..N.3.f..
0x29980	b70c00aa0060d3934c6162656c310000	.....`..Label1..
0x29990	3a4fad339966cf11b70c00aa0060d393	:O.3.f.......`..
0x299a0	466f726d000000002a4fad339966cf11	Form....*O.3.f..
0x299b0	b70c00aa0060d39354696d6572320000	.....`..Timer2..
0x299c0	54696d65723100000700000075736572	Timer1......user
0x299d0	333200001b0000005365744c61796572	32......SetLayer
0x299e0	656457696e646f774174747269627574	edWindowAttribut
0x299f0	65730000cc994200d899420000000400	es....B...B.....
0x29a00	d4c242000000000000000000a1dcc242	..B............B
0x29a10	000bc07402ffe068f4994200b8d01240	...t...h..B....@
0x29a20	00ffd0ffe00000000f00000047657457	............GetW
0x29a30	696e646f774c6f6e67410000cc994200	indowLongA....B.
0x29a40	2c9a420000000400e0c2420000000000	,.B.......B.....
0x29a50	00000000a1e8c242000bc07402ffe068	.......B...t...h
0x29a60	3c9a4200b8d0124000ffd0ffe0000000	<.B....@........
0x29a70	0f00000053657457696e646f774c6f6e	....SetWindowLon
0x29a80	67410000cc994200749a420000000400	gA....B.t.B.....
0x29a90	ecc242000000000000000000a1f4c242	..B............B
0x29aa0	000bc07402ffe068849a4200b8d01240	...t...h..B....@
0x29ab0	00ffd0ffe00000000c00500000000000	..........P.....
0x29ac0	00000000233dfbfcfaa06810a7380800	....#=....h..8..
0x29ad0	2b3371b5223dfbfcfaa06810a7380800	+3q."=....h..8..
0x29ae0	2b3371b502000000c49a4200d49a4200	+3q.......B...B.
0x29af0	00000000794fad339966cf11b70c00aa	....yO.3.f......
0x29b00	0060d393020000005c00000008000000	.`......\.......
0x29b10	2e006500780065000000000016000000	..e.x.e.........
0x29b20	04000000010000000000000000007301	..............s.
0x29b30	ffffffff01000000d94ead339966cf11	.........N.3.f..
0x29b40	b70c00aa0060d393120000005c005500	.....`......\.U.
0x29b50	6e00690063006f0072006e002d000000	n.i.c.o.r.n.-...
0x29b60	e14ead339966cf11b70c00aa00600c93	.N.3.f.......`..
0x29b70	5f5f766261467265655374724c697374	__vbaFreeStrList
0x29b80	000000001e00000063006d0064002000	........c.m.d. .
0x29b90	2f0063002000720065006e0061006d00	/.c. .r.e.n.a.m.
0x29ba0	65002000220000000c0000002e006500	e. .".........e.
0x29bb0	78006500220020000000000008000000	x.e.". .........
0x29bc0	2e006400690065000000000056424136	..d.i.e.....VBA6
0x29bd0	2e444c4c000000005f5f766261456e64	.DLL....__vbaEnd

0x7479a	ffffffffffffffffffffffffffffffff	................
0x747aa	ffffffffffff00000100010000150000	................
0x747ba	01002000c87604000100340234000000	.. ..v....4.4...
0x747ca	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0x747da	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0x747ea	0000bd04effe00000100000001000000	................
0x747fa	000000000100000000003f0000000000	..........?.....
0x7480a	00000400000001000000000000000000	................
0x7481a	00000000000094010000000053007400	............S.t.
0x7482a	720069006e006700460069006c006500	r.i.n.g.F.i.l.e.
0x7483a	49006e0066006f000000700100000000	I.n.f.o...p.....
0x7484a	30003800300034003000340042003000	0.8.0.4.0.4.B.0.
0x7485a	00002c000a00010043006f006d007000	..,.....C.o.m.p.
0x7486a	61006e0079004e0061006d0065000000	a.n.y.N.a.m.e...
0x7487a	00005500450046004900000000004000	..U.E.F.I.....@.
0x7488a	1e000100500072006f00640075006300	....P.r.o.d.u.c.
0x7489a	74004e0061006d006500000000004b00	t.N.a.m.e.....K.
0x748aa	610077006100690069002d0055006e00	a.w.a.i.i.-.U.n.
0x748ba	690063006f0072006e00000000002c00	i.c.o.r.n.....,.
0x748ca	0a000100460069006c00650056006500	....F.i.l.e.V.e.
0x748da	7200732d69006f006e00000000003100	r.s-i.o.n.....1.
0x748ea	2e00300030000000000030000a000100	..0.0.....0.....
0x748fa	500072006f0064007500630074005600	P.r.o.d.u.c.t.V.
0x7490a	65007200730069006f006e0000003100	e.r.s.i.o.n...1.
0x7491a	2e00300030000000000040001e000100	..0.0.....@.....
0x7492a	49006e007400650072006e0061006c00	I.n.t.e.r.n.a.l.
0x7493a	4e0061006d00650000004b0061007700	N.a.m.e...K.a.w.
0x7494a	6100690069002d0055006e0069006300	a.i.i.-.U.n.i.c.
0x7495a	6f0072006e0000000000500026000100	o.r.n.....P.&...
0x7496a	4f0072006900670069006e0061006c00	O.r.i.g.i.n.a.l.
0x7497a	460069006c0065006e0061006d006500	F.i.l.e.n.a.m.e.
0x7498a	00004b00610077006100690069002d00	..K.a.w.a.i.i.-.
0x7499a	55006e00690063006f0072006e002e00	U.n.i.c.o.r.n...
0x749aa	65007800650000000000440000000000	e.x.e.....D.....
0x749ba	560061007200460069006c0065004900	V.a.r.F.i.l.e.I.
0x749ca	6e0066006f0000000000240004000000	n.f.o.....$.....
0x749da	5400720061006e0073006c0061007400	T.r.a.n.s.l.a.t.
0x749ea	69006f006e00000000000408b0040000	i.o.n...........
0x749fa	00000000000000000000000000000000	................
0x74a0a	00000000000000000000000000000000	................
0x74a1a	00000000000000000000000000000000	................
0x74a2a	00000000000000000000000000000000	................
0x74a3a	00000000000000000000000000000000	................
0x74a4a	00000000000000000000000000000000	................
0x74a5a	00000000	....

0xfa0	00000000000000000000000000000000	................
0xfb0	00000000000000000000000000000000	................
0xfc0	00000000000000000000000000000000	................
0xfd0	00000000000000000000000000000000	................
0xfe0	00000000000000000000000000000000	................
0xff0	00000000000000000000000000000000	................
0x1000	8693a372f909a372ee6aa4723168a472	...r...r.j.r1h.r
0x1010	8dcca1726272a47288bea072ba02a372	...rbr.r...r...r
0x1020	c39fa1724109a372766aa2723ac3a072	...rA..rvj.r:..r
0x1030	74a2a1726e02a372fec1a17205cda172	t..rn..r...r...r
0x1040	3acda1729d49a272f19fa1720603a372	:..r.I.r...r...r
0x1050	0604a372ee94a372ea62a3727d41a172	...r...r.b.r}A.r
0x1060	749ba07210c4a1726c57a272fda09472	t..r...rlW.r...r
0x1070	f609a3720ac3a1729b05a272879ba072	...r...r...r...r
0x1080	69cea072dc19a2729395a372859aa072	i..r...r...r...r
0x1090	df47a2728906a372ba03a3721375a472	.G.r...r...r.u.r
0x10a0	5057a2725ac6a1724819a2727d69a272	PW.rZ..rH..r}i.r
0x10b0	2b94a37267e8a072103da17237a2a172	+..rg..r.=.r7..r
0x10c0	1856a272ea10a2723a03a3723a04a372	.V.r...r:..r:..r
0x10d0	016ca2726e03a372a9fda272a4359472	.l.rn..r...r.5.r
0x10e0	2f4ea272db76a472c092a372306ca272	/N.r.v.r...r0l.r
0x10f0	edeea2724496a3722198a272134ea272	...rD..r!..r.N.r
0x1100	11dda272ec6ba272af9fa17200000000	...r.k.r...r....
0x1110	21001400aea042000000000000000000	!.....B.........
0x1120	000000002811400008000000059f4200	....(.@.......B.
0x1130	0c9f42001b9f4200679f4200c49f4200	..B...B.g.B...B.
0x1140	d69f42002ea05700a7a0420000000000	..B...W...B.....
0x1150	27001400e0a6420024a74200e8a64200	'.....B.$.B...B.
0x1160	00000000681140000e00000025a14200	....h.@.....%.B.
0x1170	2ca142003ba1420063a14200cca34200	,.B.;.B.c.B...B.
0x1180	f6a342000ea442001da44200b4a44200	..B...B...B...B.
0x1190	56a54200f3a542000ba642001aa64200	V.B...B...B...B.
0x11a0	d9a6420000	..B..

20 of 23 traits shown

Identity

SHA-256	dc17f60446749b36aecb38e0e47e40f24832340c522173b4508869df0a4c315b
Filename	virussign.com_a01e7eea0525433185cb9e1eab723470.vir
Package	dc17f60446749b36aecb38e0e47e40f24832340c522173b4508869df0a4c315b

Origin

Source	harvest
Feed	virussign
Domain	virussign.com

Timeline

First seen	2 Aug 2026 13:18 UTC
First analyzed	3 Aug 2026 19:11 UTC
Last analyzed	3 Aug 2026 19:11 UTC
Last updated	3 Aug 2026 19:11 UTC

Labeling

Label	bad
Label source	harvest
Traits version	96ebe

Not seeing what you expected? Let us know

0x1b8	c4a502000010000000b0020000100000	................
0x1c8	000000000000000000000000200000d8	............ ...
0x1d8	2e64617461000000200a000000c00200	.data... .......
0x1e8	0010000000c002f00000000000000000	................
0x1f8	00000000400000c02e72737263000000	....@....rsrc...
0x208	f879040000d002000080040000d00200	.y..............
0x218	00000000000000000000000040000040	............@..@
0x228	6cda5b4a100000000000000000003800	l.[J..........8.
0x238	4d535642564d36302e444c4c00000000	MSVBVM60.DLL....Kawaii-Unicorn VB6 .die rename sabotage
0x248	00000000000000000000000000000000	................
0x258	00000000000000000000000000000000	................
0x268	00000000000000000000000000000000	................
0x278	00000000000000000000000000000000	................
0x288	00000000000000000000000000000000	................
0x298	00000000000000000000000000000000	................
0x2a8	00000000000000000000000000000000	................
0x2b8	00000000000000000000000000000000	................
0x2c8	00000000000000000000000000000000	................
0x2d8	00000000000000000000000000000000	................
0x2e8	00000000000000000000000000000000	................
0x2f8	00000000000000000000000000000000	................
0x308	00000000000000000000000000000000	................
0x318	00000000000000000000000000000000	................
0x328	00000000000000000000000000000000	................
0x338	000000000000000000000000	............